A custodial wallet puts a service provider in charge of the keys used to move your crypto. With a non-custodial, or self-custodial, wallet, you control the keys or account permissions needed to authorise transactions. The difference becomes practical when you need to withdraw, replace a phone or recover access.
Two apps can display the same balance and offer a Send button while giving you very different powers. The useful questions are: who can approve a transfer, what is needed to restore access, and what happens if the provider stops operating?
A wallet balance does not tell you who can move it
Crypto assets are recorded on a blockchain. A wallet provides the tools to view balances and authorise transactions; coins are not stored inside the phone. In a conventional key-based account, a private key produces the digital signature needed to authorise spending.
In a typical custodial arrangement, you log in to an account maintained by a provider. Your password and two-factor authentication establish permission to use that service. They do not give you the private keys controlling its blockchain addresses. A withdrawal is a request for the provider to process a transfer after its checks.
Trading within an exchange can update its internal account records without creating a separate blockchain transfer for every trade. A deposit address or an account balance therefore does not, by itself, establish that you control a dedicated on-chain wallet.
In a self-custodial wallet, the signing authority sits with you or with the account rules you have chosen. You can authorise transactions without asking a custodian to approve a withdrawal, subject to the network and asset’s rules. Ethereum’s wallet guide explains the distinction between the wallet interface and the account it accesses.
| Question | Typical custodial account | Self-custodial wallet |
|---|---|---|
| Who authorises an on-chain transfer? | The provider controls signing and processes your request | Your keys or the account’s configured authorisation rules |
| How is access recovered? | The provider’s account-recovery process | The wallet’s backup or recovery mechanism |
| What can interrupt access? | Account restrictions, service failures or withdrawal processing | Lost credentials, unavailable recovery paths or infrastructure problems |
| Who carries the operational burden? | The provider manages custody; you secure your account and assess the provider | You manage access, backups, permissions and transaction decisions |
Recovery is where the difference becomes expensive
Suppose your phone is lost. With a custodial service, access may be restored through identity checks and account recovery. That possibility depends on the provider’s procedures; it does not guarantee an immediate withdrawal or reimbursement for a compromised account.
With a phrase-based self-custodial wallet, a compatible backup can recreate the relevant keys on a replacement device. Losing the device alone need not mean losing the assets. Losing every usable copy of the keys and recovery material can make access permanently unavailable.
An app password, device PIN and recovery phrase perform different jobs. In a traditional phrase-based wallet, resetting the app password does not replace a missing backup. Other wallets use encrypted backups, passkeys or recovery contacts, so follow the specific design rather than assume every wallet works alike. KTX’s seed-phrase backup guide explains the recovery requirements in more detail.
A stolen backup is a different problem from a lost phone: someone who obtains sufficient recovery material may reproduce your signing authority. Changing an app password does not invalidate copied keys. Never send private keys or recovery words to someone offering support.
Custody and cold storage answer different questions
Custody describes who controls authorisation. Hot and cold storage describe how signing keys are kept and exposed to connected systems. A custodian can use offline storage, while a self-custodial wallet can run on an internet-connected phone.
A hardware wallet isolates signing keys from the computer or phone running the interface. This reduces some routes to key theft. It does not decide whether a recipient is trustworthy or a contract permission is sensible. You can still approve a harmful action using a genuine device. Ethereum’s security guidance covers transaction checks and token spending limits.
Seedless wallets and smart accounts need a closer look
A recovery phrase is not the only possible control mechanism. Smart accounts can use multiple signers, recovery contacts or spending rules. Multi-party computation, or MPC, can use multiple key shares to jointly produce a signature. These technologies can support different custody arrangements.
For an MPC wallet, ask who holds the shares, how many must cooperate, and whether you can recover or exit if a participant disappears. For a smart account, inspect recovery, upgrade and module permissions as well as the normal signing threshold. Safe’s module documentation, for example, explains how enabled modules can execute transactions through additional authorisation paths.
A seedless login or a self-custody label cannot answer those questions. The important test is whether the provider can move funds or alter control, and whether your documented recovery path remains usable without that provider.
Match the arrangement to the work you need it to do
Frequent exchange trading and direct interaction with on-chain applications involve different workflows. A custodial account offers access through the provider’s systems. A self-custodial wallet gives you direct transaction control, alongside responsibility for network fees, recovery and contract permissions.
Custody also raises financial questions beyond key storage: asset segregation, lending or reuse, withdrawal terms and treatment if the provider fails. Legal rights depend on the agreement and applicable law. KTX’s proof-of-reserves guide explains why visible wallet assets alone do not establish every liability or prove solvency.
If you use KTX for trading and a personal wallet for other activity, check the current deposit and withdrawal instructions on both sides. Confirm the asset, supported network, address and any required memo or tag. A small test transfer can reveal a mistake before a larger transfer, but it does not replace those checks.
Before committing a meaningful balance, establish how you would recover access after losing a device and how you would transfer out. An arrangement you cannot recover or operate reliably is a poor fit, however convenient its login screen looks.
Frequently asked questions
Can someone spend my crypto just by knowing my address?
A public address alone does not provide signing authority. However, on public blockchains it can expose balances and transaction history. Keep addresses separate from private keys and recovery material.
Does disconnecting a website remove its token permissions?
No. Disconnecting the wallet interface does not revoke existing on-chain token approvals. Review and revoke unwanted approvals through a trusted tool; MetaMask’s disconnection guide explains this distinction.
What happens if a self-custodial wallet company closes?
Access may remain possible through compatible software, backups or alternative interfaces. It depends on the network, account design and recovery format. A provider-dependent recovery service or module can complicate that exit.
Can a token still be frozen in a self-custodial wallet?
Yes, if the token’s rules permit it. For example, Circle’s USDC terms describe address blocklisting. Controlling a wallet key does not remove an issuer’s powers under the token contract.
Does restoring a wallet move the crypto to a new address?
Restoring compatible recovery material recreates access to the corresponding accounts; it does not itself transfer assets. Creating a wallet with new keys produces a different destination. Moving assets there requires separate transactions.
This article is for general education, not personalised investment or security advice. Wallet designs, recovery procedures and service terms vary. Never disclose private keys or recovery phrases.